Railway and Northflank Breaches Expose Risks in CI/CD and PaaS Credential Storage

Two October 2026 security disclosures show that build and deployment infrastructure can be a weak point even when production networks are well defended. Cloud platform Railway reported an intrusion into its build systems between October 18 and 21 that let an attacker reach internal CI environments and decrypt some customer secrets. Shortly after, container platform Northflank advised customers to assume their stored environment variables may have been decrypted and to rotate credentials right away. In both cases the problem lay in the hosting and delivery infrastructure rather than in customer application code. The article uses these incidents to argue that teams should stop treating pipelines as implicitly trusted and instead limit and eliminate static credentials stored there.